WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/workbench/execution_access.go

@@ -0,0 +1,64 @@
+package workbench
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/Tencent/WeKnora/internal/accesspolicy"
+	apperrors "github.com/Tencent/WeKnora/internal/errors"
+	"gorm.io/gorm"
+)
+
+type agentExecutionContextProvider interface {
+	PrepareAgentExecutionContext(context.Context, string) (context.Context, error)
+}
+
+func (s *Service) agentExecutionContext(ctx context.Context, id string) (context.Context, error) {
+	if provider, ok := s.agents.(agentExecutionContextProvider); ok {
+		return provider.PrepareAgentExecutionContext(ctx, id)
+	}
+	return ctx, nil
+}
+
+// Only live, readable canvas nodes can delegate execution of their owner's
+// private Agents. Client input and old task snapshots cannot add dependencies.
+func (s *Service) taskExecutionContext(ctx context.Context, d TaskData) (context.Context, error) {
+	if !accesspolicy.Allowed(ctx, "flows.read") {
+		return ctx, ErrForbidden
+	}
+	r, err := s.get(ctx, "flows", d.FlowID)
+	if err != nil {
+		return ctx, fmt.Errorf("%w: 请重新选择可用的画布模板", ErrInvalid)
+	}
+	if err = requireExecutable(r); err != nil {
+		return ctx, err
+	}
+	flow, err := decode[FlowData](r.Data)
+	if err != nil {
+		return ctx, ErrInvalid
+	}
+	if err = validateFlow(flow); err != nil {
+		return ctx, err
+	}
+	for _, node := range flow.Nodes {
+		ctx = accesspolicy.WithExecutionDependency(ctx, r.TenantID, "agents", node.AgentID, r.OwnerID)
+	}
+	for _, node := range flow.Nodes {
+		ctx, err = s.agentExecutionContext(ctx, node.AgentID)
+		if err != nil {
+			var appError *apperrors.AppError
+			configurationError := errors.Is(err, ErrForbidden) || errors.Is(err, ErrInvalid) || errors.Is(err, gorm.ErrRecordNotFound) ||
+				(errors.As(err, &appError) && appError.HTTPCode >= 400 && appError.HTTPCode < 500)
+			if !configurationError {
+				return ctx, err
+			}
+			label := node.Label
+			if label == "" {
+				label = node.ID
+			}
+			return ctx, fmt.Errorf("%w: 画布「%s」的「%s」节点引用的 Agent 或其绑定资源已删除、停用或无权使用，请在画布编排中重新选择可用 Agent 后保存", ErrInvalid, r.Name, label)
+		}
+	}
+	return ctx, nil
+}